Cisco 642-647 Online Practice Questions and Exam Preparation

Cisco 642-647 Online Questions & Answers

• Question 101:

  Refer to the exhibit.

  

  A NOC engineer needs to tune some prelogin parameters on an SSL VPN tunnel.

  From the information that is shown, where should the engineer navigate to find the prelogin session attributes?

  A. "engineering" Group Policy
  B. "contractor" Connection Profile
  C. "engineer1" AAA/Local Users
  D. DfltGrpPolicy Group Policy
  B. "contractor" Connection Profile

  ---

  http://www.cisco.com/en/US/docs/security/vpn_client/anyconnect/anyconnect30/administration/ guide/ac05hostscanposture.html#wp1039696

• Question 102:

  SIMULATION. Please check the explanation

  Correct Answer. A
  A

  ---

  

  

  Explanation: Navigate to:

  

  Address Pools:

  

  Navigate to:

  

  Connection Profiles ADD

  

  Advanced SSLVPN:

  

  Basic:

  

  Navigate to:

  

  

  Navigate back to:

  

  And update Default Group Policy

  

  Navigate to:

  

  

  Then

  

  And we have:

  

• Question 103:

  Drag and drop each advanced application deployment option on the left to its correct definition on the right.

  Select and Place:

  

  

• Question 104:

  Your corporate finance department purchased a new non-web-based TCP application tool to run on one of its servers. Certain finance employees need remote access to the software during nonbusiness hours. These employees do not have "admin" privileges to their PCs.

  What is the correct way to configure the SSL VPN tunnel to allow this application to run?

  A. Configure a smart tunnel for the application.
  B. Configure a "finance tool" VNC bookmark on the employee clientless SSL VPN portal.
  C. Configure the plug-in that best fits the application.
  D. Configure the Cisco ASA appliance to download the Cisco AnyConnect SSL VPN Client to the finance employee each time an SSL VPN tunnel is established.
  A. Configure a smart tunnel for the application.

  ---

  http://www.cisco.com/en/US/docs/security/asa/asa80/configuration/guide/webvpn.html A smart tunnel is a connection between a TCP-based application and a private site, using a clientless (browser based) SSL VPN session with the security appliance as the pathway, and the security appliance as a proxy server. You can identify applications to which you want to grant smart tunnel access, and specify the local path to each application. For applications running on Microsoft Windows, you can also require a match of the SHA-1 hash of the checksum as a condition for granting smart tunnel access. Lotus SameTime and Microsoft Outlook Express are examples of applications to which you might want to grant smart tunnel access. Configuring smart tunnels requires one of the following procedures, depending on whether the application is a client or is a web-enabled application:稢reate one or more smart tunnel lists of the client applications, then assign the list to the group policies or local user policies for whom you want to provide smart tunnel access. 稢reate one or more bookmark list entries that specify the URLs of the web-enabled applications eligible for smart tunnel access, then assign the list to the DAPs, group policies, or local user policies for whom you want to provide smart tunnel access. You can also list web-enabled applications for which to automate the submission of login credentials in smart tunnel connections over clientless SSL VPN sessions. Why Smart Tunnels? Smart tunnel access lets a client TCP-based application use a browser-based VPN connection to connect to a service. It offers the following advantages to users, compared to plug-ins and the legacy technology, port forwarding:稴mart tunnel offers better performance than plug-ins. 稶nlike port forwarding, smart tunnel simplifies the user experience by not requiring the user connection of the local application to the local port. 稶nlike port forwarding, smart tunnel does not require users to have administrator privileges. The advantage of a plug-in is that it does not require the client application to be installed on the remote computer. Smart Tunnel Requirements, Restrictions, and Limitations The following sections categorize the smart tunnel requirements and limitations. General Requirements and Limitations Smart tunnel has the following general requirements and limitations:稵he remote host originating the smart tunnel must be running a 32-bit version of Microsoft Windows Vista, Windows XP, or Windows 2000; or Mac OS 10.4 or 10.5. 稴mart tunnel auto sign-on supports only Microsoft Internet Explorer on Windows. 稵he browser must be enabled with Java, Microsoft ActiveX, or both. 稴mart tunnel supports only proxies placed between computers running Microsoft Windows and the security appliance. Smart tunnel uses the Internet Explorer configuration (that is, the one intended for system-wide use in Windows). If the remote computer requires a proxy server to reach the security appliance, the URL of the terminating end of the connection must be in the list of URLs excluded from proxy services. If the proxy configuration specifies that traffic destined for the ASA goes through a proxy, all smart tunnel traffic goes through the proxy.

  In an HTTP-based remote access scenario, sometimes a subnet does not provide user access to the VPN gateway. In this case, a proxy placed in front of the ASA to route traffic between the web and the end user's location provides web access. However, only VPN users can configure proxies placed in front of the ASA.

  When doing so, they must make sure these proxies support the CONNECT method. For proxies that require authentication, smart tunnel supports only the basic digest authentication type. 稺hen smart tunnel starts, the security appliance by default passes all browser traffic through the VPN session if the browser process is the same. The security appliance also does this if a tunnel- all policy applies. If the user starts another instance of the browser process, it passes all traffic through the VPN session. If the browser process is the same and the security appliance does not provide access to a URL, the user cannot open it. As a workaround, assign a tunnel policy that is not tunnel-all.

  稟 stateful failover does not retain smart tunnel connections. Users must reconnect following a failover.

• Question 105:

  Refer to the exhibit.

  

  A junior network engineer configured the corporate Cisco ASA appliance to accommodate a new temporary worker. For security reasons, the IT department wants to restrict the internal network access of the new temporary worker to the corporate server, with an IP address of 10.0.4.10. After the junior network engineer finished the configuration, an IT security specialist tested the account of the temporary worker. The tester was able to access the URLs of additional secure servers from the WebVPN user account of the temporary worker.

  What did the junior network engineer configure incorrectly?

  A. The ACL was configured incorrectly.
  B. The ACL was applied incorrectly or was not applied.
  C. Network browsing was not restricted on the temporary worker group policy.
  D. Network browsing was not restricted on the temporary worker user policy.
  B. The ACL was applied incorrectly or was not applied.

• Question 106:

  Refer to the exhibit.

  

  The user "contractor" inherits which VPN group policy?

  A. employee
  B. management
  C. DefaultWEBVPNGroup
  D. DfltGrpPolicy
  E. new_hire
  D. DfltGrpPolicy

• Question 107:

  On the right, a permanent (P) or temporary (T) license is added to a Cisco ASA 5520. The merged license result in new capabilities for the Cisco ASA 5520. Drag the new resultant license on the left to the merging licenses on the right.

  Select and Place:

  

  

• Question 108:

  Refer to the exhibit.

  

  In the CLI snippet that is shown, what is the function of the deny option in the access list?

  A. When set in conjunction with outbound connection-type bidirectional, its function is to prevent the specified traffic from being protected by the crypto map entry.
  B. When set in conjunction with connection-type originate-only, its function is to instruct the Cisco ASA to deny specific inbound traffic if it is not encrypted.
  C. When set in conjunction with outbound connection-type answer-only, its function is to instruct the Cisco ASA to deny specific outbound traffic if it is not encrypted.
  D. When set in conjunction with connection-type originate-only, its function is to cause all IP traffic that matches the specified conditions to be protected by the crypto map.
  A. When set in conjunction with outbound connection-type bidirectional, its function is to prevent the specified traffic from being protected by the crypto map entry.

• Question 109:

  Which statement is correct regarding IKEv2 when implementing IPsec site-to-site VPNs?

  A. IKEv2 should be configured with a higher priority over IKEv1 policies within the same tunnel group.
  B. IKEv2 crypto maps can be configured to inherit IKEv1 parameters, if configured.
  C. IKE v1 and IKEv2 can coexist in the same tunnel group, with fallback to IKEv1 if the remote endpoint does not support IKEv2.
  D. IKEv2 can be configured to support multiple peers.
  C. IKE v1 and IKEv2 can coexist in the same tunnel group, with fallback to IKEv1 if the remote endpoint does not support IKEv2.

• Question 110:

  In which three ways can a Cisco ASA security appliance obtain a certificate revocation list? (Choose three.)

  A. FTP
  B. SCEP
  C. TFTP
  D. HTTP
  E. LDAP
  F. SCP
  B. SCEP
  D. HTTP
  E. LDAP

  ---

  CRLs

  CRLs provide the ASA with one way of determining whether a certificate that is within its valid time range has been revoked by the issuing CA. CRL configuration is part of configuration of a trustpoint.

  You can configure the ASA to make CRL checks mandatory when authenticating a certificate by using the revocation-check crl command. You can also make the CRL check optional by using the revocation-check crl none command, which

  allows the certificate authentication to succeed when the CA is unavailable to provide updated CRL data.

  The ASA can retrieve CRLs from CAs using HTTP, SCEP, or LDAP. CRLs retrieved for each trustpoint are cached for a configurable amount of time for each trustpoint.

  When the ASA has cached a CRL for longer than the amount of time it is configured to cache CRLs, the ASA considers the CRL too old to be reliable, or "stale." The ASA tries to retrieve a newer version of the CRL the next time that a

  certificate authentication requires a check of the stale CRL.

  The ASA caches CRLs for an amount of time determined by the following two factors:

  稵he number of minutes specified with the cache-time command. The default value is 60 minutes. 稵he NextUpdate field in the CRLs retrieved, which may be absent from CRLs. You control whether the ASA requires and uses the NextUpdate

  field with the enforcenextupdate command. The ASA uses these two factors in the following ways:

  稩f the NextUpdate field is not required, the ASA marks CRLs as stale after the length of time defined by the cache-time command. 稩f the NextUpdate field is required, the ASA marks CRLs as stale at the sooner of the two times specified by

  the cache-time command and the NextUpdate field. For example, if the cache-time command is set to 100 minutes and the NextUpdate field specifies that the next update is 70 minutes away, the ASA marks CRLs as stale in 70 minutes.